CVE-2026-110777

Awaiting Analysis Awaiting Analysis - Queue

evolution-data-server File URI Attachment Local File Read Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110777

EUVD

EUVD-2026-101521

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	evolution-data-server	3.26
gnome	evolution-data-server	to 3.62.0 (inc)
gnome	evolution-data-server	3.62.1
gnome	evolution-data-server	From 3.26 (inc) to 3.62.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in evolution-data-server allows malicious calendar events with a file:// URI in the ATTACH property to automatically read and exfiltrate local files. When the event is saved, the system base64-encodes the file contents and uploads them back to the server without verifying if the attachment was originally from the server or added locally.

Detection Guidance

Monitor network traffic for unusual base64-encoded data uploads from evolution-data-server processes. Check calendar event logs for events containing file:// URIs in ATTACH properties. Inspect evolution-data-server logs for suspicious file read operations.

Impact Analysis

An attacker with access to your shared CalDAV calendar could trick you into interacting with a malicious event, causing arbitrary files you have access to be stolen. This could expose sensitive data like documents, configurations, or other confidential information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance penalties if sensitive data is leaked due to this flaw.

Mitigation Strategies

Upgrade evolution-data-server to version 3.62.1 or later. Disable shared CalDAV calendar access if not required. Review and remove any suspicious calendar events containing file:// URIs in attachments.

Hi! I’m here to help you understand CVE-2026-110777. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70